linux/drivers/media/usb/cpia2
Oliver Neukum eff73de2b1 media: cpia2_usb: first wake up, then free in disconnect
Kasan reported a use after free in cpia2_usb_disconnect()
It first freed everything and then woke up those waiting.
The reverse order is correct.

Fixes: 6c493f8b28 ("[media] cpia2: major overhaul to get it in a working state again")

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+0c90fc937c84f97d0aa6@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-05-28 12:26:11 -04:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
cpia2.h media: cpia2: use u64 for the timestamp internally 2019-02-07 12:12:43 -05:00
cpia2_core.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
cpia2_registers.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
cpia2_usb.c media: cpia2_usb: first wake up, then free in disconnect 2019-05-28 12:26:11 -04:00
cpia2_v4l.c media: cpia2: Fix use-after-free in cpia2_exit 2019-03-19 13:48:50 -04:00